{"id":13,"date":"2013-05-24T22:51:37","date_gmt":"2013-05-24T22:51:37","guid":{"rendered":"http:\/\/www.matthewmilcic.com\/blogs\/?p=13"},"modified":"2013-05-24T22:51:37","modified_gmt":"2013-05-24T22:51:37","slug":"vpn-on-dd-wrt-with-tp-link-tl-wr1043nd","status":"publish","type":"post","link":"http:\/\/www.matthewmilcic.com\/blogs\/?p=13","title":{"rendered":"VPN on dd-wrt with TP-LINK TL-WR1043ND"},"content":{"rendered":"<p>For work I had to create a quick VPN link to monitor some instruments off-site. \u00a0To do this I selected a TP-LINK TL-WR1043ND.<\/p>\n<p>These are nice, little, and importantly, cheap gigabit routers that are easy to upgrade to run dd-wrt. \u00a0At one point they were selling for just over $30 on Amazon.com.<\/p>\n<p>Here are my notes for installing dd-wrt and setting up the VPN:<\/p>\n<p><strong>INSTALLING DDWRT<\/strong><\/p>\n<p>Start by downloading ddwrt for the TP-LINK\u00a0<a title=\"Router Database\" href=\"http:\/\/www.dd-wrt.com\/site\/support\/router-database\">here<\/a>. \u00a0Get the factory-to-ddwrt.bin. \u00a0Please know that the published dd-wrt was incompatible with most new models of the 1043 and the WAN port wouldn&#8217;t function. \u00a0The version as of writing this is v24 pre SP2 build 21061 and I haven&#8217;t had any issues. \u00a0If you do find yourself having issues and you are daring you can try out a later image found <a title=\"Other DD-WRT Versions\" href=\"http:\/\/www.dd-wrt.com\/site\/support\/other-downloads?path=others%2Feko%2FBrainSlayer-V24-preSP2%2F\">here<\/a>.<\/p>\n<p>Once downloaded follow dd-wrt&#8217;s 30-30-30 hard reset:<\/p>\n<ul>\n<li>Hold down reset for 30 seconds.<\/li>\n<li>Unplug the device while still holding reset for 30 seconds.<\/li>\n<li>Plug in the TP-LINK and still holding reset for 30 seconds.<\/li>\n<\/ul>\n<p>So you&#8217;ll be holding down reset for a full 90 seconds.<\/p>\n<p>Then log into the the 1043. \u00a0The admin user and password are on the back of the device. \u00a0In the left navigation go to System Tools -&gt; Firmware Upgrade. \u00a0Upload the .bin you downloaded and click upgrade.<\/p>\n<div id=\"attachment_29\" style=\"width: 634px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/upgrade.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-29\" class=\"size-medium wp-image-29\" alt=\"Upgrade link for tp-link\" src=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/upgrade-624x463.png\" width=\"624\" height=\"463\" srcset=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/upgrade-624x463.png 624w, http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/upgrade-300x222.png 300w, http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/upgrade.png 818w\" sizes=\"auto, (max-width: 624px) 100vw, 624px\" \/><\/a><p id=\"caption-attachment-29\" class=\"wp-caption-text\">TP-LINK default firmware upgrade.<\/p><\/div>\n<p><strong>DD-WRT SETUP<\/strong><\/p>\n<p>Now log into the newly flashed TP-LINK. \u00a0The default IP is 192.168.1.1. \u00a0The first screen will let you set your admin user and password. \u00a0I recommend you do not use the one written on the device. \u00a0I won&#8217;t go into everything in this post, but I prefer to always turn off telnet and turn on ssh admin.<\/p>\n<div id=\"attachment_34\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/ServicesOnDDWRT.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-34\" class=\"size-full wp-image-34\" alt=\"Turn off telnet and turn on SSH\" src=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/ServicesOnDDWRT.png\" width=\"600\" height=\"324\" srcset=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/ServicesOnDDWRT.png 600w, http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/ServicesOnDDWRT-300x162.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><p id=\"caption-attachment-34\" class=\"wp-caption-text\">Turn off telnet and turn on SSH.<\/p><\/div>\n<p><strong>GENERATING KEYS AND CERTS<\/strong><\/p>\n<p>To get openvpn up and running you&#8217;ll need to build a set of keys and certificates. \u00a0You can download easy-rsa to assist with this <a title=\"Easy-RSA\" href=\"https:\/\/github.com\/OpenVPN\/easy-rsa\">here<\/a>. \u00a0There are instructions and a detailed explanation of how to use easy-rsa <a title=\"Easy-RSA instructions.\" href=\"http:\/\/openvpn.net\/index.php\/open-source\/documentation\/miscellaneous\/77-rsa-key-management.html\">here<\/a>. \u00a0A brief explanation is below.<\/p>\n<ul>\n<li>Update the vars file and fill in the country, province, city, org, email, ou.<\/li>\n<li>source the vars file <code>. .\/vars<\/code><\/li>\n<li><code>.\/clean-all<\/code><\/li>\n<li><code>.\/build-ca<\/code><\/li>\n<li><code>.\/build-dh<\/code> This will take a long time.<\/li>\n<li><code>.\/build-key-server server<\/code><\/li>\n<li><code>.\/build-key client1<\/code> This is the client name.<\/li>\n<\/ul>\n<p>You&#8217;ll now have a very well populated keys directory. \u00a0If you ever run clean-all again this will be deleted. \u00a0So back it up if you are going to start over.<\/p>\n<p>Finally you&#8217;ll need a ta.key. \u00a0To do this ssh into the TP-LINK router. \u00a0Please note the user is\u00a0<strong>root<\/strong> when ssh-ing into the router. \u00a0The password is the one you set up as an admin password originally. \u00a0When logged in run <code>openvpn --genkey --secret ta.key<\/code><\/p>\n<p>Then cat the ta.key: <code>cat ta.key<\/code><\/p>\n<p>You&#8217;ll need to save the ta.key somewhere off of the TP-LINK. \u00a0The storage there is volatile and will not survive a reboot.<\/p>\n<p><strong>CONFIGURE THE VPN SERVICE<\/strong><\/p>\n<p>Now back to the TP-LINK GUI. \u00a0dd-wrt has made this process so simple now. \u00a0You may find instructions that involve going to Administration =&gt; Commands. \u00a0That is no longer needed and everything you need is available in the GUI.<\/p>\n<p>Go to Services =&gt; VPN. \u00a0Enable the VPN server and set the UI to match this picture:<\/p>\n<div id=\"attachment_42\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerUpperSettings.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-42\" class=\"size-full wp-image-42\" alt=\"Upper settings for VPN server.\" src=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerUpperSettings.png\" width=\"600\" height=\"475\" srcset=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerUpperSettings.png 600w, http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerUpperSettings-300x237.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><p id=\"caption-attachment-42\" class=\"wp-caption-text\">Upper settings for VPN server.<\/p><\/div>\n<p>Now add the keys and certs to the spaces documented in the image. \u00a0Please only add the text inbetween the &#8212;&#8212;&lt;Text&gt;&#8212;&#8211;&lt;Base64&gt;&#8212;&#8212;&lt;Text&gt;&#8212;&#8212;<\/p>\n<div id=\"attachment_43\" style=\"width: 574px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerKeys.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-43\" class=\"size-full wp-image-43\" alt=\"OpenVPN key and cert settings.\" src=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerKeys.png\" width=\"564\" height=\"393\" srcset=\"http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerKeys.png 564w, http:\/\/www.matthewmilcic.com\/blogs\/wp-content\/uploads\/2013\/05\/openvpnServerKeys-300x209.png 300w\" sizes=\"auto, (max-width: 564px) 100vw, 564px\" \/><\/a><p id=\"caption-attachment-43\" class=\"wp-caption-text\">OpenVPN key and cert settings.<\/p><\/div>\n<p>Hit Save and then Apply Settings<\/p>\n<p><strong>VPN CLIENT INSTALL<\/strong><\/p>\n<p>These instructions are Windows focused for the client:<\/p>\n<ul>\n<li>\u00a0Download the OpenVPN <a title=\"OpenVPN software\" href=\"http:\/\/openvpn.net\/index.php\/open-source\/downloads.html\">software<\/a> and select 32 bit or 64 bit per your system.<\/li>\n<li>Right click and install the software as admin.<\/li>\n<li>Navigate to C:\\Program Files\\OpenVPN\\config<\/li>\n<li>Add the ca.crt, client1.key, client1.crt, and ta.key to the config directory<\/li>\n<li>Add the client.ovpn config (I&#8217;ll post below).<\/li>\n<\/ul>\n<p><strong>VPN CLIENT CONFIG FILE<\/strong><\/p>\n<p><code>client<br \/>\ndev tap<br \/>\nproto udp<br \/>\ntls-auth ta.key 1<br \/>\nremote &lt;your_remote_server&gt;<br \/>\nresolv-retry infinite<br \/>\nnobind<br \/>\npersist-tun<br \/>\npersist-key<br \/>\nca ca.crt<br \/>\ncert client1.crt<br \/>\nkey client1.key<br \/>\nns-cert-type server<br \/>\ncomp-lzo<br \/>\nverb 3<\/code><\/p>\n<p>Save this as client1.ovpn<\/p>\n<p><strong>CONNECTING TO THE REMOTE SERVER<\/strong><\/p>\n<p>Find the OpenVPN GUI in the Windows start menu. \u00a0Right click and run as admin. \u00a0This will add an icon in your system tray. \u00a0Right click on the item and select connect.<\/p>\n<p>You will now be connected to the remote network. \u00a0You can check by running a cmd terminal and issuing <code>ipconfig<\/code>.  This will list your interfaces and one should be on the remote network.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For work I had to create a quick VPN link to monitor some instruments off-site. \u00a0To do this I selected a TP-LINK TL-WR1043ND. These are nice, little, and importantly, cheap gigabit routers that are easy to upgrade to run dd-wrt. \u00a0At one point they were selling for just over $30 on Amazon.com. Here are my [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[7,6],"class_list":["post-13","post","type-post","status-publish","format-standard","hentry","category-technical","tag-ddwrt","tag-vpn"],"_links":{"self":[{"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/posts\/13","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13"}],"version-history":[{"count":10,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions"}],"predecessor-version":[{"id":50,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions\/50"}],"wp:attachment":[{"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.matthewmilcic.com\/blogs\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}